{"id":"CVE-2026-34002","title":"Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling","summary":"A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, w…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","cvssSource":"cna","cwe":["CWE-805"],"vendor":"Red Hat","product":"xorg-x11-server-Xwayland","affected":["xorg-x11-server-Xwayland (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server","tigervnc (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-05-06T14:27:00.488000Z"},"published":"2026-05-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:29:02.857Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-34002","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:20547","label":"RHSA-2026:20547"},{"url":"https://access.redhat.com/errata/RHSA-2026:20555","label":"RHSA-2026:20555"},{"url":"https://access.redhat.com/errata/RHSA-2026:20557","label":"RHSA-2026:20557"},{"url":"https://access.redhat.com/errata/RHSA-2026:20558","label":"RHSA-2026:20558"},{"url":"https://access.redhat.com/errata/RHSA-2026:20560","label":"RHSA-2026:20560"},{"url":"https://access.redhat.com/errata/RHSA-2026:20561","label":"RHSA-2026:20561"},{"url":"https://access.redhat.com/errata/RHSA-2026:20562","label":"RHSA-2026:20562"},{"url":"https://access.redhat.com/errata/RHSA-2026:20563","label":"RHSA-2026:20563"},{"url":"https://access.redhat.com/errata/RHSA-2026:20575","label":"RHSA-2026:20575"},{"url":"https://access.redhat.com/errata/RHSA-2026:20576","label":"RHSA-2026:20576"},{"url":"https://access.redhat.com/errata/RHSA-2026:20590","label":"RHSA-2026:20590"},{"url":"https://access.redhat.com/errata/RHSA-2026:21699","label":"RHSA-2026:21699"},{"url":"https://access.redhat.com/errata/RHSA-2026:21712","label":"RHSA-2026:21712"},{"url":"https://access.redhat.com/errata/RHSA-2026:21715","label":"RHSA-2026:21715"},{"url":"https://access.redhat.com/errata/RHSA-2026:21716","label":"RHSA-2026:21716"},{"url":"https://access.redhat.com/errata/RHSA-2026:21718","label":"RHSA-2026:21718"},{"url":"https://access.redhat.com/errata/RHSA-2026:21741","label":"RHSA-2026:21741"},{"url":"https://access.redhat.com/errata/RHSA-2026:21742","label":"RHSA-2026:21742"},{"url":"https://access.redhat.com/errata/RHSA-2026:22424","label":"RHSA-2026:22424"},{"url":"https://access.redhat.com/errata/RHSA-2026:22456","label":"RHSA-2026:22456"},{"url":"https://access.redhat.com/errata/RHSA-2026:23254","label":"RHSA-2026:23254"},{"url":"https://access.redhat.com/errata/RHSA-2026:23255","label":"RHSA-2026:23255"},{"url":"https://access.redhat.com/errata/RHSA-2026:23496","label":"RHSA-2026:23496"},{"url":"https://access.redhat.com/errata/RHSA-2026:24341","label":"RHSA-2026:24341"},{"url":"https://access.redhat.com/security/cve/CVE-2026-34002"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451112","label":"RHBZ#2451112"}],"tags":["cve.org"],"epss":0.00489,"epssPercentile":0.42228,"ingestedAt":"2026-11-05T22:38:31.790Z","slug":"CVE-2026-34002","body":"## Overview\n\nA flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.\n\n## Affected\n\n- `xorg-x11-server-Xwayland (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this vulnerability, restrict access to the X11 server. If the X.Org X server is not required on a system, consider disabling or uninstalling it. For systems where the X server is necessary, ensure that access is limited to trusted users and networks. This can involve configuring `xhost` or implementing firewall rules to restrict connections to the X server. Any changes to X server configuration or service status may require a restart of the X server for the mitigation to take effect, which will impact active graphical sessions.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}